3 ms·

I've not looked in detail, but I'm not so sure about the security of generating windows via URL parameters. I feel like there's an XSS in that for sure. Edit:

I've not looked in detail, but I'm not so sure about the security of generating windows via URL parameters. I feel like there's an XSS in that for sure. Edit: there is https://golden-layout.com/?gl-window=%7B%22g%22%3A%5B%7B%22o%22%3A%22Layout%22%2C%22l%22%3A%225%22%2C%22h%22%3A%22demo%22%2C%22i%22%3A%7B%22bg%22%3A%22%5C%22%3E%3Csvg%20onload%3Dalert(1)%3E%22%7D%2C%22n%22%3A%220%22%7D%5D%7D https://golden-layout.com/?gl-window=%7B%22g%22%3A%5B%7B%22o... Please don't chastise me for disclosure ethics, this one was low-hanging fruit.

wolframhempel 12y ago
good point. What it passes via URL parameter is URL encoded JSON - which is parsed using JSON.parse()... so shouldn't expose an attack vector. The alternative - creating about:blank windows and moving DOM elements into them comes with a wealth of glitches and restrictions
- tshadwell 12y ago
  I realise that, but unless every piece of information in the JSON is dealt with caution (which I doubt from experience) it could be possible to put together an attack. Well, I should probably verify that myself.
- tshadwell 12y ago
  I edited my original post to include a working XSS exploit.
  - wolframhempel 12y ago
    Wow...impressive. Even though this is not so much a weakness o f Goldenlayout as rather the particular image component I use on the startpage. Still though, thanks. Remind me to hire you if I want to get back at someone.
    - tshadwell 12y ago
      Usually I work to prevent problems rather than create them but hey I could be the antagonist in someone's novel. I doubt that's not the only exploit in the library either. I could go through it with a finer toothed comb if you wanted.
      - wolframhempel 12y ago
        I'd be forever grateful. I imagine this one to be quite tough since it's ultimately up to the user to create and read serializable state objects for their components.

wolframhempel 12y ago

good point. What it passes via URL parameter is URL encoded JSON - which is parsed using JSON.parse()... so shouldn't expose an attack vector. The alternative - creating about:blank windows and moving DOM elements into them comes with a wealth of glitches and restrictions

tshadwell 12y ago
I realise that, but unless every piece of information in the JSON is dealt with caution (which I doubt from experience) it could be possible to put together an attack. Well, I should probably verify that myself.
tshadwell 12y ago
I edited my original post to include a working XSS exploit.
- wolframhempel 12y ago
  Wow...impressive. Even though this is not so much a weakness o f Goldenlayout as rather the particular image component I use on the startpage. Still though, thanks. Remind me to hire you if I want to get back at someone.
  - tshadwell 12y ago
    Usually I work to prevent problems rather than create them but hey I could be the antagonist in someone's novel. I doubt that's not the only exploit in the library either. I could go through it with a finer toothed comb if you wanted.
    - wolframhempel 12y ago
      I'd be forever grateful. I imagine this one to be quite tough since it's ultimately up to the user to create and read serializable state objects for their components.